mirror of https://github.com/luxfi/magnetar.git synced 2026-07-27 02:53:47 +00:00

Files

T

Lux Magnetar 83ce56ff0f magnetar v1.0.0: ONE construction per regime; THBS-SE permissionless threshold

Magnetar v1.0.0 closes the permissionless-threshold story at ONE
construction --- THBS-SE (Threshold Hash-Based Signatures with
Selected-Element Reconstruction) --- and removes every legacy
seed-recombine path from the codebase.

The two production primitives at v1.0:

1. Per-validator standalone (standalone.go, unchanged from v0.5.x) ---
   the public-BFT primary primitive. Each validator holds its own FIPS
   205 keypair, signs independently, consensus collects N signatures
   into a ValidatorAggregateCert.

2. THBS-SE (thbsse.go + thbsse_field.go) --- the permissionless
   threshold companion. t-of-n committee, slot-bound commit-and-reveal,
   PUBLIC COMBINER role (anyone-can-combine, no host in TCB at sign
   time), slashable equivocation and malformed-share evidence.

Both emit byte-identical FIPS 205 signatures that unmodified verifiers
accept (TestMagnetar_Wire_FIPS205Verifiable +
TestThbsSE_Wire_FIPS205Verifiable across all 3 SHAKE modes).

Hard invariant (THBS-SE): a revealed value is allowed only if it is
also present in the final SLH-DSA signature. Forbidden reveals:
SK.seed in any party-local persistent form, SK.prf, future-slot share
material. The slot guard refuses any same-slot re-emission.

v1.0 honest open item: the strict "no transient seed at any moment"
invariant requires a v1.1 strict-atom-assembly path
(BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11) that re-implements FIPS 205
sec 5/6/7/8 internally. v1.0 ships a PUBLIC COMBINER that holds the
seed for one slhdsa.SignDeterministic call and zeroizes; materially
stronger than TEE-attested privileged-aggregator constructions,
materially weaker than the strict refinement.

8 test gates + 2 bonus correctness checks:
- TestThbsSE_Wire_FIPS205Verifiable (3 modes) -- byte identity
- TestThbsSE_RejectSeedReveal
- TestThbsSE_RejectUnselectedFORS
- TestThbsSE_RejectUnselectedWOTS
- TestThbsSE_SlotReuseRejected
- TestThbsSE_OverselectedCommittee
- TestThbsSE_SlotBindingDomainSeparation
- BenchmarkThbsSE_Sign_5of7
- TestThbsSE_PublicCombiner_Determinism (bonus)
- TestKAT_ThbsSe (n=7, t=4, 3 modes, 3 messages)

Removed (legacy seed-recombine path + the proofs/CT scaffolding that
modeled it):

- ref/go/pkg/magnetar/{threshold,aggregate,combine,shamir,dkg}.go
  + tests
- ref/go/pkg/magnetar/{e2e,fuzz,n1_byte_equality}_test.go
- ref/go/pkg/thbs/ (entire subtree including dkg2/ PVSS skeleton)
- vectors/{threshold-sign,dkg}.json
- jasmin/{threshold,lib}/ (legacy seed-recombine model)
- proofs/easycrypt/ (entire tree; v1.1 ports to THBS-SE)
- ct/dudect/ (entire tree; v1.1 lands with strict-atom path)
- scripts/{check-lean-bridge,checks/ec-*,checks/jasmin,checks/extraction}.sh

Added:

- ref/go/pkg/magnetar/thbsse.go (1054 LOC; the THBS-SE construction)
- ref/go/pkg/magnetar/thbsse_field.go (GF(257) internal share math)
- ref/go/pkg/magnetar/thbsse_test.go (8 gates + 2 bonus)
- vectors/thbsse-sign.json (deterministic (n=7,t=4) KAT)
- v1.0 supersede notices on v0.x archival docs

Verification:
- GOWORK=off go build ./... && go vet ./...: clean
- go test -count=1 -short: PASS (all gates)
- go test -count=1 -race -short: PASS
- grep "reveal-and-aggregate|seed.*recombin|THBS over.*seed|aggregator.*reconstruct.*seed" *.go: 0 matches
- find ref/go/pkg -type d -name thbs: empty

2026-06-01 12:03:22 -07:00

2.2 KiB

Raw Permalink Blame History

Magnetar --- constant-time analysis track

Magnetar v1.0 routes ALL FIPS 205 SLH-DSA operations through cloudflare/circl/sign/slhdsa v1.6.3. CIRCL's slhdsa package is the upstream CT-audited reference; its constant-time posture is the constant-time posture inherited by both Magnetar primitives:

Per-validator standalone (ref/go/pkg/magnetar/standalone.go) --- ValidatorSign is a thin wrapper around slhdsa.SignDeterministic. No Magnetar-side secret-dependent branches. The CT property is the CT property of CIRCL slhdsa v1.6.3 verbatim.
THBS-SE (ref/go/pkg/magnetar/thbsse.go + thbsse_field.go) --- the share arithmetic surface (commit-bind, Lagrange reconstruct over GF(257), mix-to-seed, dispatch to CIRCL slhdsa) is straight-line modular arithmetic with no secret-dependent branches:
- thbsseModInvSmall / thbsseModPowSmall operate on the PUBLIC prime exponent p-2, not on a secret exponent.
- The Lagrange basis lambdas are functions of PUBLIC evaluation points only.
- The per-byte share multiplication is one uint32 mul + one % 257 per byte position --- no branching on share value.
- The commit re-derivation in Combine and deriveThbsSeCommit is a cSHAKE256 absorb, which is CT by CIRCL's golang.org/x/ crypto/sha3 implementation.

v1.0 ship status

The v0.x dudect harness has been removed --- it modeled the abandoned seed-recombine Combine and Verify API surfaces that no longer exist in the codebase. The v1.0 THBS-SE construction has a substantially smaller CT-critical surface (no DKG state, no intermediate Round1Message struct lifetime, no per-party MAC ladder), and the CIRCL slhdsa upstream covers the heavy SLH-DSA work.

v1.1 plan

The v1.1 dudect harness re-lands once the strict-atom-assembly construction lands (BLOCKERS.md::MAGNETAR-STRICT-ATOM-V11). At that point a small Magnetar-internal re-implementation of FIPS 205 sec 5/6/7/8 surfaces enters the trusted computing base, and a dudect harness over the per-atom WOTS+ chain + FORS sign step becomes the right CT analytical surface. v1.0's CT story is "inherit CIRCL"; v1.1's CT story is "inherit CIRCL for FIPS 205 sec 0--4 + dudect for the Magnetar-internal sec 5--8 surface".

2.2 KiB Raw Permalink Blame History

Magnetar --- constant-time analysis track

v1.0 ship status

v1.1 plan

2.2 KiB

Raw Permalink Blame History